@openparachute/hub 0.7.6 → 0.7.7-rc.13

package/src/services-manifest.ts

@@ -623,7 +623,8 @@ export function readManifestLenient(
     );
     return { services: [] };
   }
-  const afterRetired = dropRetiredModuleRows(raw, path);
+  const healed = healStaleUiHostAppRows(raw, path);
+  const afterRetired = dropRetiredModuleRows(healed.raw, path);
   const cleaned = dropLegacyShortNameRows(afterRetired.raw, path);
   // `typeof null === "object"` in JS, so the `!cleaned.raw` part of this
   // guard is load-bearing for the null case — not a typo or redundancy.
@@ -671,23 +672,29 @@ export function readManifest(path: string = SERVICES_MANIFEST_PATH): ServicesMan
       `failed to parse ${path}: ${err instanceof Error ? err.message : String(err)}`,
     );
   }
-  // Retired-module + legacy short-name row cleanup runs BEFORE shape
+  // Row-heal + retired-module + legacy short-name cleanup all run BEFORE shape
   // validation because the bugs they heal (rows that conflict on port with
   // a current row) would otherwise throw inside `validateManifest`'s
-  // duplicate-port gate. Order matters: drop retired-module rows FIRST so
-  // their absence can unmask a `parachute-<X>` ↔ `<X>` pair underneath that
-  // `dropLegacyShortNameRows` then handles. The reverse order would leave
-  // a retired row that the short-name pass doesn't recognize. Both passes
-  // mutate the raw JSON object's `services` array; we re-validate against
-  // the cleaned shape. See `dropRetiredModuleRows` + `dropLegacyShortNameRows`
-  // for the full discipline.
-  const afterRetired = dropRetiredModuleRows(raw, path);
+  // duplicate-port gate. Order matters:
+  //   1. `healStaleUiHostAppRows` FIRST — a pre-rename operator can carry BOTH
+  //      a `parachute-app` AND an `app` stale row (2026-05-22 double-write
+  //      reproducer); dropping by OLD-UI-host shape here clears both, whereas
+  //      `dropLegacyShortNameRows` would keep the `parachute-app` half. Runs
+  //      ahead of the retired-module pass too (the `app`/`parachute-app`
+  //      RETIRED_MODULES entries were removed in hub-parity P5 — the names are
+  //      the NEW app's now — so this shape-gated heal is their replacement).
+  //   2. `dropRetiredModuleRows` — drop genuinely-retired rows so their
+  //      absence can unmask a `parachute-<X>` ↔ `<X>` pair underneath that
+  //   3. `dropLegacyShortNameRows` then handles.
+  // Each pass mutates the raw JSON object's `services` array; we re-validate
+  // against the cleaned shape. See the three helpers for the full discipline.
+  const healed = healStaleUiHostAppRows(raw, path);
+  const afterRetired = dropRetiredModuleRows(healed.raw, path);
   const cleaned = dropLegacyShortNameRows(afterRetired.raw, path);
   const validated = validateManifest(cleaned.raw, path);
-  const migrated = migrateClawToAgent(validated);
-  const changed = afterRetired.changed || cleaned.changed || migrated.changed;
-  if (changed) writeManifest(migrated.manifest, path);
-  return migrated.manifest;
+  const changed = healed.changed || afterRetired.changed || cleaned.changed;
+  if (changed) writeManifest(validated, path);
+  return validated;
 }
 
 /**
@@ -724,7 +731,12 @@ function dropRetiredModuleRows(raw: unknown, where: string): { raw: unknown; cha
     if (!row || typeof row !== "object") return true;
     const name = (row as Record<string, unknown>).name;
     if (typeof name !== "string") return true;
-    const retired = RETIRED_MODULES[name];
+    // `claw` is too generic to reserve globally, but the historical Agent row
+    // had a structural identity: name=claw mounted at /claw. Retire only that
+    // shape; an unrelated third-party `claw` on another mount remains valid.
+    const paths = (row as Record<string, unknown>).paths;
+    const retiredClawShape = name === "claw" && Array.isArray(paths) && paths[0] === "/claw";
+    const retired = RETIRED_MODULES[name] ?? (retiredClawShape ? RETIRED_MODULES.agent : undefined);
     if (retired === undefined) return true;
     dropped.push({ name, retiredAt: retired.retiredAt, replacement: retired.replacement });
     return false;
@@ -745,6 +757,91 @@ function dropRetiredModuleRows(raw: unknown, where: string): { raw: unknown; cha
   };
 }
 
+/**
+ * Heal stale OLD-UI-host `app`/`parachute-app` rows on load (hub-parity P5,
+ * 2026-07-11).
+ *
+ * Context: the name `parachute-app` originally belonged to the UI-host module
+ * that renamed to `parachute-surface` on 2026-05-27 (patterns#102). Its
+ * retirement used to be handled by a `RETIRED_MODULES` entry that
+ * `dropRetiredModuleRows` GC'd unconditionally. Hub-parity P5 REUSES the
+ * `parachute-app` manifestName (+ the bare `app` short) for a genuinely NEW,
+ * unrelated module — the super-surface front door — so that retirement entry
+ * had to be removed (keeping it would GC the new module's own row on every
+ * read). This heal is the surgically narrow replacement for the ONE case the
+ * removed retirement still needs to cover: an operator upgrading DIRECTLY from
+ * a pre-rename release (~0.5.13-stable) who skipped every intermediate boot
+ * that would have GC'd their stale row. Without a heal, that stale row would:
+ *   - crash-loop on boot — `reconcilePortToCanonical` rewrites its port to
+ *     1944, then the supervisor spawns the app static-serve shim against a
+ *     `@openparachute/parachute-app` that isn't installed → exit 1 → a
+ *     forever-restarting "app" unit the operator never installed;
+ *   - hijack `/surface/*` if a real `parachute-surface` row is also present
+ *     (both claim `/surface`);
+ *   - and, after `parachute install app`, keep its stale `/surface` mount so
+ *     the app serves under `/surface` while the install's `root_redirect=/app/`
+ *     points the front page at a 404.
+ *
+ * Discriminant (structural — pinned against the OLD-UI-host row shape verified
+ * in `git show origin/main`'s retired-`app` + legacy-short-name test fixtures:
+ * `port: 1946`, `paths: ["/surface"]`, `health: "/surface/..."`):
+ *   - `name` is exactly `"app"` or `"parachute-app"`, AND
+ *   - it is NOT the NEW app's own row (the new app mounts at `/app` — never
+ *     healed regardless of port), AND
+ *   - it carries the OLD-UI-host signature: `paths[0]` is `/surface`-rooted OR
+ *     `port === 1946` (the old canonical slot; now `parachute-surface`'s).
+ *
+ * The NEW app row (`paths: ["/app"]`, port 1944) is structurally disjoint on
+ * BOTH clauses, so it is always left intact. Matches `dropRetiredModuleRows`'s
+ * behavior: a plain DROP + a stderr warning steering the operator to
+ * `parachute install surface` (the same replacement the retirement named).
+ *
+ * Operates on raw JSON (before `validateManifest`) because a stale row can
+ * collide on port 1946 with a real `parachute-surface` row and would otherwise
+ * trip the duplicate-port gate before this heal runs. Runs FIRST in the load
+ * pipeline (ahead of `dropRetiredModuleRows` / `dropLegacyShortNameRows`): a
+ * pre-rename operator can carry BOTH a `parachute-app` and an `app` stale row
+ * (the 2026-05-22 double-write reproducer) — dropping by shape here clears
+ * both, whereas `dropLegacyShortNameRows` would keep the `parachute-app` half.
+ */
+function healStaleUiHostAppRows(raw: unknown, where: string): { raw: unknown; changed: boolean } {
+  if (!raw || typeof raw !== "object") return { raw, changed: false };
+  const services = (raw as Record<string, unknown>).services;
+  if (!Array.isArray(services)) return { raw, changed: false };
+
+  const dropped: string[] = [];
+  const nextServices = services.filter((row) => {
+    if (!row || typeof row !== "object") return true;
+    const rec = row as Record<string, unknown>;
+    const name = rec.name;
+    if (name !== "app" && name !== "parachute-app") return true;
+    const paths = rec.paths;
+    const first = Array.isArray(paths) && typeof paths[0] === "string" ? paths[0] : undefined;
+    // NEW super-surface app mounts at `/app` (port 1944) — never heal it,
+    // whatever its port happens to be after a reconcile/collision walk.
+    if (first === "/app" || first?.startsWith("/app/")) return true;
+    const port = rec.port;
+    const oldSurfaceMount = first === "/surface" || first?.startsWith("/surface/") === true;
+    const oldCanonicalPort = port === 1946;
+    if (!oldSurfaceMount && !oldCanonicalPort) return true;
+    dropped.push(String(name));
+    return false;
+  });
+
+  if (dropped.length === 0) return { raw, changed: false };
+
+  for (const name of dropped) {
+    console.error(
+      `${where}: dropped stale pre-rename '${name}' row (the OLD UI-host module, renamed to parachute-surface 2026-05-27). The name now belongs to the new Parachute app (mount /app, port 1944). If an old daemon is still running, stop it; install the current UI host with \`parachute install surface\`.`,
+    );
+  }
+
+  return {
+    raw: { ...(raw as Record<string, unknown>), services: nextServices },
+    changed: true,
+  };
+}
+
 /**
  * Drop legacy short-name rows when a same-module manifestName row exists
  * on the same port. Handles the duplicate-row class introduced when a
@@ -836,43 +933,6 @@ function dropLegacyShortNameRows(raw: unknown, where: string): { raw: unknown; c
   };
 }
 
-/**
- * Migrate legacy `claw` entries to `agent` in-place. Paraclaw was renamed
- * to parachute-agent across the ecosystem (npm package, mount path, short
- * name); operators who upgraded hub but still have the old paraclaw row
- * in services.json would otherwise see a tile labelled "Claw" and a hub
- * route at `/claw` while their newly-upgraded daemon listens on `/agent`.
- *
- * Idempotent. Only rewrites when both `name === "claw"` AND the first path
- * is `/claw` — narrow enough that a deliberately-named third-party module
- * (e.g. `name: "claw"` on a different mount) is left alone. Health and any
- * `/claw`-rooted paths are rewritten in lockstep.
- */
-function migrateClawToAgent(manifest: ServicesManifest): {
-  manifest: ServicesManifest;
-  changed: boolean;
-} {
-  let changed = false;
-  const services = manifest.services.map((entry) => {
-    if (entry.name !== "claw" || entry.paths[0] !== "/claw") return entry;
-    changed = true;
-    const next: ServiceEntry = {
-      ...entry,
-      name: "agent",
-      paths: entry.paths.map((p) => rewriteClawPath(p)),
-      health: rewriteClawPath(entry.health),
-    };
-    return next;
-  });
-  return { manifest: { services }, changed };
-}
-
-function rewriteClawPath(p: string): string {
-  if (p === "/claw") return "/agent";
-  if (p.startsWith("/claw/")) return `/agent${p.slice("/claw".length)}`;
-  return p;
-}
-
 export function writeManifest(
   manifest: ServicesManifest,
   path: string = SERVICES_MANIFEST_PATH,

package/src/sessions.ts

@@ -4,12 +4,21 @@
  * with that cookie skip the login form and go straight to consent.
  *
  * Stored in `sessions` (one row per active session), so logout / forced
- * revocation is just a delete. Sessions are SLIDING: `expires_at` starts at
- * `created_at + SESSION_TTL_MS`, and {@link touchSession} pushes it forward on
- * genuine activity (the admin SPA re-mints `/admin/host-admin-token` every
- * ~10 min while a tab is open). An idle session — no more mints — still
- * expires at the original 24h mark, and {@link SESSION_MAX_LIFETIME_MS} caps
- * total life so sliding can't keep a left-open tab alive forever.
+ * revocation is just a delete. Sessions are ROLLING (hub-parity P1, Q4 —
+ * adopts cloud's posture): `expires_at` starts at `created_at + SESSION_TTL_MS`
+ * (90 days), and {@link touchSession} pushes it forward on genuine activity
+ * (the admin SPA re-mints `/admin/host-admin-token` every ~10 min while a tab
+ * is open; `GET /account/session`, the app's boot/poll oracle, slides once it
+ * crosses {@link SESSION_SLIDE_THRESHOLD_MS} of its life — see
+ * `account-session.ts`). There is NO absolute ceiling: an ACTIVELY-used
+ * session rolls forward indefinitely, while an idle one (no more touches)
+ * still lapses at the 90-day mark. Was 24h sliding / 30d hard cap through
+ * 2026-07; the cap is gone. The ONLY thing that terminates a session row today
+ * is logout (which deletes it). Note what does NOT: the admin screen-lock gates
+ * token MINTS (it does not touch or expire the session row), and per-user
+ * session revocation does not exist yet (P6-era). So an actively-used session
+ * — including a stolen cookie — currently lives on until 90 idle days or an
+ * explicit logout; a per-user revoke lever is the standing gap to close.
  *
  * The cookie value is the session id directly. It's a 32-byte base64url
  * random; collision is statistically impossible. No HMAC needed because the
@@ -20,16 +29,25 @@ import type { Database } from "bun:sqlite";
 import { randomBytes } from "node:crypto";
 
 export const SESSION_COOKIE_NAME = "parachute_hub_session";
-export const SESSION_TTL_MS = 24 * 60 * 60 * 1000;
+/**
+ * Session lifetime — 90 days (hub-parity P1, Q4: adopts cloud's rolling
+ * posture). A session (and its cookie Max-Age) lasts 90 days from its last
+ * slide; {@link findSession} still expires it hard past this, and logout
+ * deletes the row outright. Was 24h (sliding, 30d hard cap) prior to this PR.
+ */
+export const SESSION_TTL_MS = 90 * 24 * 60 * 60 * 1000;
 
 /**
- * Absolute ceiling on a session's total lifetime, independent of sliding
- * renewal. Sliding ({@link touchSession}) keeps an active console signed in,
- * but a left-open-but-idle tab whose background polls keep re-minting must
- * still be force-logged-out eventually — this caps life at
- * `created_at + SESSION_MAX_LIFETIME_MS` so renewal can't extend forever.
+ * Roll a session forward once it has been used past this much of its life
+ * (30 days) — so an ACTIVE session stays alive indefinitely, while an idle one
+ * still expires at the full 90-day TTL. Callers that slide on every touch
+ * (the admin SPA's host-admin-token re-mint) don't need this threshold; it's
+ * for a POLLING caller like `GET /account/session` (the app's `/check-email`
+ * screen hits it every few seconds) that must NOT rewrite the row on every
+ * request — see `shouldSlideSession` there. Mirrors cloud's
+ * `SESSION_REFRESH_THRESHOLD_MS` (`workers/identity/src/sessions.ts`).
  */
-export const SESSION_MAX_LIFETIME_MS = 30 * 24 * 60 * 60 * 1000;
+export const SESSION_SLIDE_THRESHOLD_MS = 30 * 24 * 60 * 60 * 1000;
 
 export interface Session {
   id: string;
@@ -91,30 +109,33 @@ export function findSession(
 }
 
 /**
- * Slide a session's expiry forward to `now + SESSION_TTL_MS`, capped at
- * `created_at + SESSION_MAX_LIFETIME_MS`. No-op when the session doesn't exist.
+ * Slide a session's expiry forward to `now + SESSION_TTL_MS`. No-op when the
+ * session doesn't exist. NO ceiling (hub-parity P1, Q4) — cloud's posture,
+ * adopted here: an ACTIVELY-used session rolls forward forever; a closed tab
+ * / idle client (no more touches) still expires `SESSION_TTL_MS` after its
+ * last activity. The old absolute cap (`SESSION_MAX_LIFETIME_MS`, 30d) is
+ * removed — the bounds on a rolling session are logout, the admin
+ * screen-lock, and (P6-era) per-user delete, not a lifetime ceiling.
  *
- * This is what makes sessions sliding rather than fixed-24h: the admin SPA
- * re-mints `/admin/host-admin-token` roughly every ~10 min while a tab is open,
- * and each successful mint calls this — so an actively-used console isn't
- * hard-logged-out at the 24h mark, while a closed tab (no more mints) still
- * expires 24h after its last activity. The ceiling bounds a left-open-but-idle
- * tab (background polls keep re-minting) so sliding can't run forever.
+ * This is what makes sessions sliding rather than fixed-TTL: the admin SPA
+ * re-mints `/admin/host-admin-token` roughly every ~10 min while a tab is
+ * open, and each successful mint calls this unconditionally; `GET
+ * /account/session` (the app's boot/poll oracle) instead calls this only
+ * past `SESSION_SLIDE_THRESHOLD_MS` of remaining life (bounded slide — see
+ * `account-session.ts`), since it's polled every few seconds and an
+ * unconditional touch there would rewrite the row on every poll.
  *
  * Monotonic in practice: the production wall clock only moves forward, so the
- * slid value never undershoots a previously-written expiry; once it reaches the
- * ceiling it stays pinned there. (The write is unconditional — it does not read
- * the current expiry — so an injected backward `now` in tests would shorten the
- * session: a conservative failure mode, not a security issue.) `now` is
- * injectable for tests, matching {@link findSession}.
+ * slid value never undershoots a previously-written expiry. (The write is
+ * unconditional — it does not read the current expiry — so an injected
+ * backward `now` in tests would shorten the session: a conservative failure
+ * mode, not a security issue.) `now` is injectable for tests, matching
+ * {@link findSession}.
  */
 export function touchSession(db: Database, id: string, now: () => Date = () => new Date()): void {
   const row = db.query<Row, [string]>("SELECT * FROM sessions WHERE id = ?").get(id);
   if (!row) return;
-  const nowMs = now().getTime();
-  const slidMs = nowMs + SESSION_TTL_MS;
-  const ceilingMs = new Date(row.created_at).getTime() + SESSION_MAX_LIFETIME_MS;
-  const newExpiresAt = new Date(Math.min(slidMs, ceilingMs)).toISOString();
+  const newExpiresAt = new Date(now().getTime() + SESSION_TTL_MS).toISOString();
   db.prepare("UPDATE sessions SET expires_at = ? WHERE id = ?").run(newExpiresAt, id);
 }
 
@@ -122,6 +143,21 @@ export function deleteSession(db: Database, id: string): void {
   db.prepare("DELETE FROM sessions WHERE id = ?").run(id);
 }
 
+/**
+ * Should this live session be rolled forward? True once it has been used past
+ * {@link SESSION_SLIDE_THRESHOLD_MS} of its life — i.e. its remaining life has
+ * dropped below `SESSION_TTL_MS - SESSION_SLIDE_THRESHOLD_MS`. A
+ * freshly-created/-slid session is NOT slid; one that's crossed the threshold
+ * is. Pure — the caller (`account-session.ts`'s bounded slide, the G3 twin of
+ * cloud's `shouldSlideSession`) does the write ({@link touchSession}) + cookie
+ * re-issue only when this returns true, bounding both to ~once per threshold
+ * per session even under frequent polling.
+ */
+export function shouldSlideSession(session: Session, now: () => Date = () => new Date()): boolean {
+  const remainingMs = new Date(session.expiresAt).getTime() - now().getTime();
+  return remainingMs < SESSION_TTL_MS - SESSION_SLIDE_THRESHOLD_MS;
+}
+
 /**
  * Build a `Set-Cookie` header value for the given session id. HttpOnly +
  * SameSite=Lax + Secure (conditional) + Path=/.

package/src/surface-notes-alias.ts

@@ -0,0 +1,126 @@
+/**
+ * `/surface/notes` → `/surface/parachute` conditional alias (W2-12).
+ *
+ * The app's surface identity renamed from `notes` to `parachute`
+ * (parachute-app W2-12): a FUTURE install of the renamed surface package
+ * mounts at `/surface/parachute`, while every EXISTING install keeps
+ * serving notes-ui at `/surface/notes` — mounts are per-install on-disk
+ * identities, so nothing moves until an operator re-installs.
+ *
+ * The failure this alias exists for: an in-place upgrade that re-adds the
+ * renamed package over an existing `notes` instance flips the mount to
+ * `/surface/parachute`, orphaning every `/surface/notes/*` bookmark, PWA
+ * install, and in-vault link. This helper is the safety net — when (and
+ * only when) the manifest shows the legacy mount GONE and the new mount
+ * PRESENT, `/surface/notes/*` 301s to `/surface/parachute/*` with the
+ * sub-path tail and query string preserved.
+ *
+ * Condition — decided on the `uis{}` sub-units' **mount paths**, not their
+ * map keys:
+ *
+ *   - fire  ⇔ no `uis{}` sub-unit (across every services.json row) is
+ *             mounted at or under `/surface/notes`, AND some sub-unit is
+ *             mounted at exactly `/surface/parachute`.
+ *
+ * The W2-12 plan phrased this as "uis has no `notes` key and has a
+ * `parachute` key". Keys and paths coincide in the default install shape
+ * (surface-host keys `uis{}` by the surface's effective `meta.name` and
+ * defaults the mount to `/surface/<name>` — see parachute-surface
+ * admin-routes.ts `buildUisExtraField`), but they diverge exactly in the
+ * scenario this alias protects: re-adding the renamed package with
+ * `instance_name=notes` and no `mount_path` keeps the key `notes` while
+ * the PATH flips to `/surface/parachute`. A key-based condition would sit
+ * inert there and let the bookmarks 404; the path-based condition asks the
+ * routing question directly (the same `ui.path` values `resolveUiMount`
+ * matches on), so it fires precisely when `/surface/notes` stopped
+ * resolving and `/surface/parachute` started. It also can never redirect
+ * INTO a 404: the target mount's existence is part of the condition.
+ *
+ * INERT TODAY on every live install, on both branches of the condition:
+ * an existing notes-ui install either carries a `uis{}` sub-unit mounted
+ * at `/surface/notes` (legacy-mount-present → no redirect) or — as on
+ * installs whose surface-host row predates `uis{}` self-registration —
+ * carries no `/surface/parachute` mount (new-mount-absent → no redirect).
+ * Nothing fires until a surface actually registers at `/surface/parachute`.
+ *
+ * Dispatch placement (hub-server.ts): immediately BEFORE the generic
+ * services.json proxy — the same spot in the order where `resolveUiMount`
+ * reads the manifest — so every hub-owned prefix has had its turn and a
+ * live `/surface/notes` mount is never preempted (the condition already
+ * guarantees that, but the ordering keeps the alias out of the hot path
+ * for all non-`/surface/notes` traffic).
+ *
+ * Relationship to `notes-redirect.ts`: that module bridges the OLDER
+ * `/notes/*` → `/surface/notes/*` rename (notes-as-app Phase 2) and is
+ * untouched by W2-12 — its target keeps serving notes-ui on existing
+ * installs. On a post-rename install the two compose: `/notes/x` → 301
+ * `/surface/notes/x` → 301 `/surface/parachute/x`.
+ */
+
+import type { ServiceEntry } from "./services-manifest.ts";
+
+/** The legacy mount — the app's pre-W2-12 surface identity (notes-ui). */
+export const LEGACY_SURFACE_NOTES_MOUNT = "/surface/notes";
+
+/** The app's surface mount — the post-W2-12 identity. */
+export const APP_SURFACE_PARACHUTE_MOUNT = "/surface/parachute";
+
+/**
+ * Matches the legacy app-surface mount: bare `/surface/notes`, the
+ * trailing-slash form, and any sub-path. Boundary-checked — `/surface/notesy`
+ * and `/surface/notes-archive` do NOT match. Same shape as
+ * `isLegacyNotesPath` in notes-redirect.ts.
+ */
+export function isSurfaceNotesPath(pathname: string): boolean {
+  return (
+    pathname === LEGACY_SURFACE_NOTES_MOUNT || pathname.startsWith(`${LEGACY_SURFACE_NOTES_MOUNT}/`)
+  );
+}
+
+/**
+ * Decide whether a `/surface/notes*` request should 301 to the
+ * `/surface/parachute*` twin. Returns the target (path + preserved query)
+ * when the condition holds, `undefined` otherwise.
+ *
+ * `services` is the lenient manifest read (`readManifestLenient(...).services`)
+ * — the same source `resolveUiMount` consumes, re-read per request so the
+ * alias tracks a surface-host re-registration without a hub restart.
+ *
+ * Normalization mirrors `resolveUiMount`: trailing slashes stripped before
+ * comparison. The legacy-mount check treats a sub-unit mounted at OR UNDER
+ * `/surface/notes` as "the legacy identity still resolves" (a deeper mount
+ * like `/surface/notes/foo` would still serve real content under the
+ * prefix — redirecting across it would hijack a live route). The target
+ * check requires an EXACT `/surface/parachute` mount — a deeper-only mount
+ * would leave the redirect landing on a 404, which this alias exists to
+ * prevent, not cause.
+ */
+export function maybeRedirectSurfaceNotes(
+  pathname: string,
+  search: string,
+  services: readonly ServiceEntry[],
+): string | undefined {
+  if (!isSurfaceNotesPath(pathname)) return undefined;
+
+  let legacyMountResolves = false;
+  let appMountPresent = false;
+  for (const entry of services) {
+    if (!entry.uis) continue;
+    for (const ui of Object.values(entry.uis)) {
+      const norm = ui.path.replace(/\/+$/, "") || "/";
+      if (
+        norm === LEGACY_SURFACE_NOTES_MOUNT ||
+        norm.startsWith(`${LEGACY_SURFACE_NOTES_MOUNT}/`)
+      ) {
+        legacyMountResolves = true;
+      }
+      if (norm === APP_SURFACE_PARACHUTE_MOUNT) {
+        appMountPresent = true;
+      }
+    }
+  }
+  if (legacyMountResolves || !appMountPresent) return undefined;
+
+  const tail = pathname.slice(LEGACY_SURFACE_NOTES_MOUNT.length);
+  return `${APP_SURFACE_PARACHUTE_MOUNT}${tail}${search}`;
+}

package/src/__tests__/admin-agent-token.test.ts

@@ -1,173 +0,0 @@
-/**
- * Tests for the agent UI session→bearer mint endpoint. Mirrors
- * `admin-host-admin-token.test.ts` shape (agent has a single bare audience,
- * no per-vault name). Covers:
- *   - 401 when no admin session cookie is present.
- *   - 401 when the cookie names a deleted session.
- *   - 405 on POST.
- *   - 200 + JWT carrying `aud: "agent"` and `agent:read agent:send agent:admin`.
- *   - First-admin gate: 403 for a signed-in non-first-admin (friend); the
- *     admin's happy path still mints when a friend exists alongside.
- */
-import type { Database } from "bun:sqlite";
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { AGENT_TOKEN_TTL_SECONDS, handleAgentToken } from "../admin-agent-token.ts";
-import { hubDbPath, openHubDb } from "../hub-db.ts";
-import { validateAccessToken } from "../jwt-sign.ts";
-import { SESSION_TTL_MS, buildSessionCookie, createSession, deleteSession } from "../sessions.ts";
-import { rotateSigningKey } from "../signing-keys.ts";
-import { createUser } from "../users.ts";
-
-const ISSUER = "https://hub.test";
-
-interface Harness {
-  db: Database;
-  cleanup: () => void;
-}
-
-function makeHarness(): Harness {
-  const dir = mkdtempSync(join(tmpdir(), "phub-agent-token-"));
-  const db = openHubDb(hubDbPath(dir));
-  return {
-    db,
-    cleanup: () => {
-      db.close();
-      rmSync(dir, { recursive: true, force: true });
-    },
-  };
-}
-
-let harness: Harness;
-beforeEach(() => {
-  harness = makeHarness();
-});
-afterEach(() => {
-  harness.cleanup();
-});
-
-async function withSession(): Promise<{ cookie: string; userId: string }> {
-  const user = await createUser(harness.db, "operator", "hunter2");
-  const session = createSession(harness.db, { userId: user.id });
-  const cookie = buildSessionCookie(session.id, Math.floor(SESSION_TTL_MS / 1000));
-  return { cookie, userId: user.id };
-}
-
-/**
- * Seed an admin (first-created user) + a second non-admin "friend" account,
- * return cookies + ids for both. Used by the first-admin-gate tests.
- */
-async function withAdminAndFriend(): Promise<{
-  adminCookie: string;
-  adminId: string;
-  friendCookie: string;
-  friendId: string;
-}> {
-  const admin = await createUser(harness.db, "admin", "admin-passphrase");
-  const friend = await createUser(harness.db, "alice", "alice-passphrase", {
-    allowMulti: true,
-  });
-  const adminSession = createSession(harness.db, { userId: admin.id });
-  const friendSession = createSession(harness.db, { userId: friend.id });
-  return {
-    adminCookie: buildSessionCookie(adminSession.id, Math.floor(SESSION_TTL_MS / 1000)),
-    adminId: admin.id,
-    friendCookie: buildSessionCookie(friendSession.id, Math.floor(SESSION_TTL_MS / 1000)),
-    friendId: friend.id,
-  };
-}
-
-describe("handleAgentToken", () => {
-  test("401 when no session cookie is present", async () => {
-    const req = new Request(`${ISSUER}/admin/agent-token`);
-    const res = await handleAgentToken(req, { db: harness.db, issuer: ISSUER });
-    expect(res.status).toBe(401);
-    const body = (await res.json()) as { error: string };
-    expect(body.error).toBe("unauthenticated");
-  });
-
-  test("401 when the cookie names a deleted session", async () => {
-    const { cookie } = await withSession();
-    const sid = cookie.match(/parachute_hub_session=([^;]+)/)?.[1] ?? "";
-    deleteSession(harness.db, sid);
-    const req = new Request(`${ISSUER}/admin/agent-token`, { headers: { cookie } });
-    const res = await handleAgentToken(req, { db: harness.db, issuer: ISSUER });
-    expect(res.status).toBe(401);
-  });
-
-  test("405 on POST", async () => {
-    const { cookie } = await withSession();
-    const req = new Request(`${ISSUER}/admin/agent-token`, {
-      method: "POST",
-      headers: { cookie },
-    });
-    const res = await handleAgentToken(req, { db: harness.db, issuer: ISSUER });
-    expect(res.status).toBe(405);
-  });
-
-  test("200 mints a JWT carrying aud:agent + agent:read agent:send agent:admin", async () => {
-    const { cookie, userId } = await withSession();
-    rotateSigningKey(harness.db);
-    const req = new Request(`${ISSUER}/admin/agent-token`, { headers: { cookie } });
-    const res = await handleAgentToken(req, { db: harness.db, issuer: ISSUER });
-    expect(res.status).toBe(200);
-    expect(res.headers.get("cache-control")).toBe("no-store");
-
-    const body = (await res.json()) as { token: string; expires_at: string; scopes: string[] };
-    // `agent:send` (post) + `agent:read` (SSE replies) + `agent:admin`
-    // (config UI list/edit — 2026-06-09 modular-UI architecture P3). Deliberately
-    // NOT `agent:write` — that's the session-reply scope a UI token must not hold.
-    expect(body.scopes).toEqual(["agent:read", "agent:send", "agent:admin"]);
-    expect(body.scopes).not.toContain("agent:write");
-    expect(body.token.length).toBeGreaterThan(20);
-
-    const expMs = new Date(body.expires_at).getTime();
-    const skew = expMs - Date.now();
-    expect(skew).toBeGreaterThan((AGENT_TOKEN_TTL_SECONDS - 30) * 1000);
-    expect(skew).toBeLessThan((AGENT_TOKEN_TTL_SECONDS + 30) * 1000);
-
-    const validated = await validateAccessToken(harness.db, body.token, ISSUER);
-    expect(validated.payload.sub).toBe(userId);
-    expect(validated.payload.iss).toBe(ISSUER);
-    // Bare service audience — agent validates `aud === "agent"`
-    // (parachute-agent src/hub-jwt.ts).
-    expect(validated.payload.aud).toBe("agent");
-    const scopeClaim = (validated.payload as { scope?: string }).scope ?? "";
-    const scopes = scopeClaim.split(/\s+/);
-    expect(scopes).toContain("agent:read");
-    expect(scopes).toContain("agent:send");
-    expect(scopes).toContain("agent:admin");
-    expect(scopes).not.toContain("agent:write");
-  });
-
-  test("403 not_admin when a signed-in non-first-admin (friend) hits the endpoint", async () => {
-    // Privesc closure (mirrors host/vault-admin-token). The friend's session
-    // is valid; the endpoint must refuse because session.userId isn't the
-    // first-admin row.
-    const { friendCookie } = await withAdminAndFriend();
-    rotateSigningKey(harness.db);
-    const req = new Request(`${ISSUER}/admin/agent-token`, {
-      headers: { cookie: friendCookie },
-    });
-    const res = await handleAgentToken(req, { db: harness.db, issuer: ISSUER });
-    expect(res.status).toBe(403);
-    const body = (await res.json()) as { error: string; error_description: string };
-    expect(body.error).toBe("not_admin");
-    expect(body.error_description).toContain("/account/");
-  });
-
-  test("first-admin path still succeeds when a friend exists alongside", async () => {
-    const { adminCookie, adminId } = await withAdminAndFriend();
-    rotateSigningKey(harness.db);
-    const req = new Request(`${ISSUER}/admin/agent-token`, {
-      headers: { cookie: adminCookie },
-    });
-    const res = await handleAgentToken(req, { db: harness.db, issuer: ISSUER });
-    expect(res.status).toBe(200);
-    const body = (await res.json()) as { token: string };
-    const validated = await validateAccessToken(harness.db, body.token, ISSUER);
-    expect(validated.payload.sub).toBe(adminId);
-  });
-});